Do you have a picture of the other side of that vertical daughter board?
Try applying 3.3v to the RST pin also GPIO2 should be floating or pulled to ground. GPIO0 to ground.
The SKU is 1005731250
1 Like
There isn’t much on the daughterboard on the other side. The LeedArson assembly, containing the ESP32, is soldered onto the daughterboard and that daughterboard connects to the power and color channels, in addition to exposing the connections you saw on the other side.
On the daughterboard, R is PWM1, which the documentation says is GPIO0. B is GPIO2.
I have tried applying ground to those while plugging in the USB to UART adaptor, still nothing, ESPHome times out when trying to upload.
After digging into one of these Home Depot devices (Defiant HPPA11CWB) with the same chipset, I see a message that seems to indicate that the bootloader has Download Mode disabled 
1 Like
I can confirm the bootloader seems to be disabled. I have the Smart Recessed Kit from Commercial Electric that bought from Home Depot. The module is a LA02301. I ended doing a transplant with a M5Stack Stamp. Still a little too big for the enclosure but I can 3D print one.
I connected the Red to G26, Green to G25, Blue to G18, WW to G19 and CW to G22. I connected “D” to G21 but I couldn’t figure how it works.
{“NAME”:“Afero Recessed”,“GPIO”:[0,0,0,0,0,0,0,0,0,0,0,0,0,0,418,420,0,0,419,0,0,417,416,0,0,0,0,0,0,1,0,0,0,0,0,0],“FLAG”:0,“BASE”:1}
I recently grabbed a couple of the Commercial Electric Smart Dimmer with Motion Sensor devices due to the claim of having BT and WiFi connectivity, with the hope that that entailed having an ESP32 inside.
Sure enough, it appears to be an ESP32 by Afero, Inc., but I’m not aware of what pin is GPIO0 based on the board markings and the back of the ESP32 chip being obscured. This would be SUCH A COOL product if I could get ESPHome on it, as I really like the clean look and the built-in PIR.
Is there any way to force new firmware on the ESP32 or emulate an OTA update that anyone knows of? @parrotmac and @csaleman you both have at least some knowledge it seems of the bootloader being disabled.
If someone can post a picture of the back of that ESP32 chip being used, I’d love to at least figure out which pin is GPIO0 to try entering flash mode for this device!
Pictures of the board in this product (I moved the QR sticker off the heat shield while checking for markings):
.
Hi @taylorlightfoot any success on flashing? I have the same board in my smart plug. Wanted to follow your path if you have succeeded.
1 Like
I haven’t tried since last commenting. Issac seems to be onto something as to why it’s not working. Best guess is the OEM have their software encrypted and some sort of protection mode enabled so people can’t read their code. I don’t know enough about this stuff, I’ve only flashed a handful of ESP devices, and most were dev boards bought with that intention. I’ve flashed a Sonoff basic with ESPHome though.
There is no code to read. Just binary that could be decoded into assembler code, but that’s all someone could do.
I suspect that the manufacturer burned an eFuse that write protects progmem.
Just a guess.
So, buy an ESP32 module, flash espHome on it then solder it to the light’s PCB.
I am also working the Commercial Electric Smart Dimmer with Motion Sensor. Good idea on a transplant, might try with a wemos on the next one I pick up. The chip is the same
LA02301 mentioned by the OP.
I almost have the Hubspace API reversed engineered. The company says they are interested in providing an API and were not 100% thrilled that I said I was working on figuring it out. Anyways, as of now, I can go from Username/password all the way to reading device state. I think it could be easily turned off by the developer if they figure out what I am doing… @boilermaker I’ll tag you in to test it once I get it working if you are ok using python command line.
1 Like
Thanks for the mention @jaaem. It sounds like you’ve done some good work on this. I returned the smart motion dimmers after confirming that they weren’t able to be flashed and for now I’m using some Linkind dimmers (4-pack seems unavailable on Amazon, and they don’t have motion obviously). Amusingly, the Linkind dimmers have a circuit board that has nearly the same features for a PIR to be included in the circuitry for future products, it appears.
There are a number of folks over on the digiblur Discord who are eager to get a motion dimmer working locally and were all eager to see if this Commercial Electric product would be usable. I would imagine some of them still have the hardware handy if you want some much more savvy people trying to give some python commands a shot.
No local control, but got on/off integrated into homeassistant via the cloud.
1 Like
Here are some photos of the pinout of the module. I got them from the FCC website. I hope that helps someone with the dimmer. I am interested in using the dimmer if someone can make it work.
This is a link to the manual for the module, showing a pinout description
https://fccid.io/2AB2Q-LA02301/User-Manual/11-User-Manual-4810925.pdf
As a note if you ground “Factory” pin on boot, then your can use serial pins (factory serial) to talk with the chip. Speed is 460800,8N1.
It would reply with 0xD9 to any input, I guess it is a sync frame of a kind.
“Factory” protocol itself remains a mystery.
Without any input it would output repeating sequence at 1 byte per second.
(hex)
49 64 40 49 D9 D9 D9 64 64 64 49 64 64 49 D9 40 D9 49 49 49 40 64 40 40 64 64 40 40 D9 64 49 49 49
Just picked up an outdoor timer with this same ESP32 in it. Did anyone figure out how to flash it or successfully replace it with an unlocked one?
Interesting thread, and Ive been following these ideas for a couple weeks now that Ive “discovered” HA and the “ratgdo” based on ESP32.
Curious if anyone has thought about just replacing the chip on the module itself? Seems the base chip is a couple bucks and with a hot-air gun once could simply float it off and replace the thing - that should eliminate the eFuse issue. While I haven’t gone down this path myself (I simply dont have some of the equipment at the moment), I did take a similar route several years back when I crossed 5v and 12 rails on a power supply - blowing up several hard drives in the process… its really scary with tens of TB’s data on the line - but having a buddy that had the necessary tools was a lifesaver).In short, floating ROM’s off controller boards onto a donor board… seems this would be very similar.
I have a few of the Home Depot “Hubspace” products (great for outdoor Christmas light switching), but haven’t wasted much time as I only use them a few weeks per year… but it seems like something worth fooling with.
Thoughts?
Which ESP will replace this one? Don’t see any links to buy a LA02301 on Google.
I love those bulbs, but they are controlled by hubspace. I wonder if they can be flashed. I have to research and see.
https://www.homedepot.com/p/EcoSmart-60-Watt-Equivalent-Smart-A19-Clear-Color-Changing-CEC-LED-Light-Bulb-with-Voice-Control-1-Bulb-Powered-by-Hubspace-12CFA1960WRGB01/326010996